<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Does anybody have any ideas here?<div>It seems that PF_RING has fixed the issue with timeout on sigterm when there is no traffic but Suricata is still freezing.</div><div><br></div><div>BTW, I am experiencing this on a server where there are about 900 packets a minute. So maybe this is some other issue.</div><div><br></div><div>Thank you.</div><div><br><div><hr id="stopSpelling">From: coolyasha@hotmail.com<br>To: eric@regit.org; andi@geekosphere.org; oisf-users@lists.openinfosecfoundation.org<br>Date: Thu, 24 Dec 2015 14:37:01 +0000<br>Subject: Re: [Oisf-users] suricata freezes if no or little traffic is present on monitored interface<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">I've tried newer version of PFRING. 6.2 and 6.3 No luck. Here is an interesting note in the 6.2 release notes:<div><span style="font-family:'Open Sans', 'Helvetica Neue', Helvetica, sans-serif;font-size:14px;line-height:21px;background-color:rgb(255, 255, 255);">PF_RING-aware Libpcap</span><ul style="padding-right:0px;padding-left:0px;border:0px;font-size:14px;vertical-align:baseline;font-family:'Open Sans', 'Helvetica Neue', Helvetica, sans-serif;line-height:21px;background:rgb(255, 255, 255);"><li style="padding:0px;border:0px;vertical-align:baseline;background:transparent;">Fixed pcap_brekloop (tcpdump now handles sigterm correctly when there is no traffic)</li></ul><div><br></div><div>Is this what you were talking about?</div><div><br></div><div>So this sensor does get some broadcast traffic. My other sensors that have similar amount of traffic on monitored interfaces dont get stuck.</div><div><br></div><div>On this one, I get errors when trying to stop it right after starting it. Suricata reports:</div><div><div><Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine unable to disable detect thread - "RxPFReth22". Killing engine</div></div><div><br></div><div><br></div><div>I've enabled debugging in PF_RING and nothing shows until that message appears above.</div><div><br></div><div>When I try to reload rules, it starts the rebuild of grouping structure but never gives "rules reload complete" message. </div><div><br></div><div>I understand your suggestion to switch to another capture method but it seems that this should work with small amount of packets on monitored interface as it does on other sensors.</div><div><br></div><div>BTW, I've tried Suricata-3.0 with no luck.</div><div><br></div><div>Thank you for your help.</div><br><div>> Subject: Re: [Oisf-users] suricata freezes if no or little traffic is present on monitored interface<br>> From: eric@regit.org<br>> To: coolyasha@hotmail.com; andi@geekosphere.org; oisf-users@lists.openinfosecfoundation.org<br>> Date: Mon, 14 Dec 2015 17:26:05 +0100<br>> <br>> Hi,<br>> <br>> On Mon, 2015-12-14 at 16:17 +0000, Yasha Zislin wrote:<br>> > I am going to give a shot to newer version of PF_RING and if it<br>> > doesnt fix it, I will test Suricata 3.0RC2<br>> <br>> No need to test suricata 3.0rc2 it won't fix the issue. You better<br>> switch to another capture method.<br>> <br>> ++<br>> <br>> > <br>> > Thanks.<br>> > <br>> > > Date: Mon, 14 Dec 2015 16:34:14 +0100<br>> > > From: andi@geekosphere.org<br>> > > To: oisf-users@lists.openinfosecfoundation.org<br>> > > Subject: Re: [Oisf-users] suricata freezes if no or little traffic<br>> > is present on monitored interface<br>> > > <br>> > > On 14/12/15 at 15:30, Yasha Zislin wrote:<br>> > > > I am running CentOS 6 64 bit with suricata 2.1 beta4.I have not<br>> > tried<br>> > > > Suricata 3.0RC. I am curious to see if there is a way to fix that<br>> > on<br>> > > > my current version. Thank you. <br>> > > <br>> > > Could you try 3.0RC2 to see if it's solved in that version?<br>> > > This could save a lot of time investigating the issue if it's<br>> > resolved<br>> > > within 3.0RC2.<br>> > > <br>> > > -- <br>> > > Andreas Herz<br>> > > _______________________________________________<br>> > > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.o<br>> > rg<br>> > > Site: http://suricata-ids.org | Support: http://suricata-ids.org/su<br>> > pport/<br>> > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf<br>> > -users<br>> > > Suricata User Conference November 4 & 5 in Barcelona: http://oisfev<br>> > ents.net<br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/supp<br>> > ort/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-u<br>> > sers<br>> > Suricata User Conference November 4 & 5 in Barcelona: http://oisfeven<br>> > ts.net<br>> -- <br>> Eric Leblond <eric@regit.org><br>> Blog: https://home.regit.org/<br>> <br>> <br></div></div> </div>
<br>_______________________________________________
Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org
Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
Suricata User Conference November 4 & 5 in Barcelona: http://oisfevents.net</div></div> </div></body>
</html>